M3b follow-up: align REST tests and version table with policy v5 #51

Merged

adrian.tkacz merged 2 commits from m3b-rest-adapter into develop

2026-09-07 15:22:08 +00:00

kilo commented

2026-09-07 10:44:50 +00:00

Member

Implements the M3b REST adapter slice for #47 (parent issue), including the single remediation pass.

Integration note

The main M3b implementation (REST adapter, typed application seam, D-030,
tests and docs) was committed as 3475da1 and integrated into develop by the
owner together with the operating-policy v5 update (PR #50), producing develop
head a0d9ca9. This PR carries the follow-up consistency fix and the four narrow
review-blocker remediations on top. No M3c implementation is included.

M3b implementation and remediation

exact four REST endpoints over the shared application/core; no transport-owned
selection, scarcity, provider or simulation semantics
stdlib HTTPServer / BaseHTTPRequestHandler only; fixed 127.0.0.1 bind,
default port 8765, serialized requests, no runtime dependency, no auth/TLS
strict JSON/request parsing, exact missing/null semantics, 1 MiB body limit,
no chunked bodies and safe 400/500 envelopes
semantic failures applying schema-valid simulation overrides use the narrow
SimulationOverrideApplicationError, translate through
simulate_from_inputs to ApplicationInputError, and return HTTP 400
invalid_request; internal/catalog/collector failures remain HTTP 500
every request requires exactly one exact loopback Host value, either the
bare address or the actual bound port, before endpoint dispatch; missing,
duplicate and foreign hosts are rejected without echoing the value, closing
the DNS-rebinding gap in the no-auth loopback boundary
decimal Content-Length magnitude is bounded before integer conversion;
pathological digit strings return HTTP 400 without echoing or logging
M3b references are consistently D-030; legitimate operating-policy D-029
references are preserved

Parity and validation

REST select, simulate and status results remain equal to the direct typed
application/core results, with CLI delegation unchanged
full suite: 868 tests passed
make check: passed
uv run basedpyright: 0 errors / 0 warnings / 0 notes
uv run python -m scarcity_router.server --help: passed
git diff --check: passed
origin/develop remained a0d9ca953f during push
origin/m3b-rest-adapter and local HEAD are
7265023a3a
origin/develop..HEAD contains the existing follow-up plus this single
remediation commit; no merge commits
model catalog, model policy, ratings, profiles, selector/ranking semantics,
capacity/provider code and MCP remain unchanged

Human merge gate: leave PR #51 open and unmerged.

Implements the M3b REST adapter slice for #47 (parent issue), including the single remediation pass. ## Integration note The main M3b implementation (REST adapter, typed application seam, D-030, tests and docs) was committed as 3475da1 and integrated into `develop` by the owner together with the operating-policy v5 update (PR #50), producing develop head a0d9ca9. This PR carries the follow-up consistency fix and the four narrow review-blocker remediations on top. No M3c implementation is included. ## M3b implementation and remediation - exact four REST endpoints over the shared application/core; no transport-owned selection, scarcity, provider or simulation semantics - stdlib `HTTPServer` / `BaseHTTPRequestHandler` only; fixed `127.0.0.1` bind, default port 8765, serialized requests, no runtime dependency, no auth/TLS - strict JSON/request parsing, exact missing/null semantics, 1 MiB body limit, no chunked bodies and safe 400/500 envelopes - semantic failures applying schema-valid simulation overrides use the narrow `SimulationOverrideApplicationError`, translate through `simulate_from_inputs` to `ApplicationInputError`, and return HTTP 400 `invalid_request`; internal/catalog/collector failures remain HTTP 500 - every request requires exactly one exact loopback `Host` value, either the bare address or the actual bound port, before endpoint dispatch; missing, duplicate and foreign hosts are rejected without echoing the value, closing the DNS-rebinding gap in the no-auth loopback boundary - decimal `Content-Length` magnitude is bounded before integer conversion; pathological digit strings return HTTP 400 without echoing or logging - M3b references are consistently D-030; legitimate operating-policy D-029 references are preserved ## Parity and validation - REST select, simulate and status results remain equal to the direct typed application/core results, with CLI delegation unchanged - full suite: 868 tests passed - `make check`: passed - `uv run basedpyright`: 0 errors / 0 warnings / 0 notes - `uv run python -m scarcity_router.server --help`: passed - `git diff --check`: passed - `origin/develop` remained a0d9ca953fc2bb59c5952b3170591603aa4c0277 during push - `origin/m3b-rest-adapter` and local `HEAD` are 7265023a3ada51e233033755d4bc68bc5c941abc - `origin/develop..HEAD` contains the existing follow-up plus this single remediation commit; no merge commits - model catalog, model policy, ratings, profiles, selector/ranking semantics, capacity/provider code and MCP remain unchanged Human merge gate: leave PR #51 open and unmerged.

kilo added 1 commit

2026-09-07 10:44:50 +00:00

M3b follow-up: align REST tests and version table with policy v5 13e2105cd7

The operating-policy v5 update (PR #50) raised model-policy.json to
policy_version 5 after the M3b REST adapter landed; the upstream merge
updated the CLI test but the REST profile-path assertion and the
machine-interface versioning table still said 4.

creatidy-admin added 1 commit

2026-09-07 14:37:58 +00:00

M3b remediation: harden REST input boundaries 7265023a3a

adrian.tkacz approved these changes

2026-09-07 15:22:02 +00:00

adrian.tkacz merged commit c212dbfb79 into develop

2026-09-07 15:22:08 +00:00

adrian.tkacz deleted branch m3b-rest-adapter

2026-09-07 15:22:08 +00:00

adrian.tkacz referenced this pull request from a commit

2026-09-07 15:22:09 +00:00

Merge pull request 'M3b follow-up: align REST tests and version table with policy v5' (#51) from m3b-rest-adapter into develop